AAT separates robust and non-robust features without supervision.
problem Adversarial vulnerability and accuracy reduction in machine learning models.
method Adversarial Asymmetric Training (AAT) algorithm.
result Preserves accuracy and achieves better disentanglement than previous methods.
Batch normalization shifts models to rely more on non-robust features.
problem Understanding the impact of batch normalization on deep neural networks.
method Empirical analysis and a framework for disentangling robustness and usefulness.
result Batch normalization increases reliance on non-robust features, decreasing adversarial robustness.
Gradient descent biases neural networks to use an average of features, leading to non-robustness.
problem Non-robustness in neural networks due to feature averaging.
method Theoretical analysis and experiments on binary classification tasks.
result Gradient descent trains networks to rely on an average of features, making them vulnerable to adversarial attacks.
It has been shown that instead of learning actual object features, deep networks tend to exploit non-robust (spurious) discriminative features that are shared between training and test sets. Therefore, while they achieve state of the art performance on such test sets, they achieve poor generalization on out of distribu…
New datasets reveal neural networks can rely on simple features, leading to poor generalization.
problem Neural networks' reliance on simple features can lead to poor generalization and robustness.
method Designing datasets with varying levels of simplicity and incorporating non-robustness.
result Neural networks can exclusively rely on the simplest feature, leading to poor performance on complex data.
Adversarial examples have attracted significant attention in machine learning, but the reasons for their existence and pervasiveness remain unclear. We demonstrate that adversarial examples can be directly attributed to the presence of non-robust features: features derived from patterns in the data distribution that ar…
Study analyzes and enhances robustness of neural networks for classification and regression.
problem Understanding and improving robustness of neural network predictions.
method Computes reachable sets of neural networks using over- and under-approximations.
result Approach outperforms adversarial attacks and state-of-the-art classifier verification methods.
The vulnerability to slight input perturbations is a worrying yet intriguing property of deep neural networks (DNNs). Despite many previous works studying the reason behind such adversarial behavior, the relationship between the generalization performance and adversarial behavior of DNNs is still little understood. In …
Improves robust transfer learning with side information.
problem Addressing environmental shift in MDPs with side information.
method Estimate-centered uncertainty sets with side information integration.
result Improved robust policy with reduced sub-optimality gap.
Recent works show that Graph Neural Networks (GNNs) are highly non-robust with respect to adversarial attacks on both the graph structure and the node attributes, making their outcomes unreliable. We propose the first method for certifiable (non-)robustness of graph convolutional networks with respect to perturbations …
DVERGE diversifies adversarial vulnerabilities to enhance robust ensemble models.
problem Diverse adversarial vulnerabilities for robust ensemble models.
method Isolates and diversifies adversarial vulnerabilities through distillation and training.
result Achieves higher robustness against transfer attacks compared to previous methods.
Adversarial training has been successfully applied to build robust models at a certain cost. While the robustness of a model increases, the standard classification accuracy declines. This phenomenon is suggested to be an inherent trade-off. We propose a model that employs feature prioritization by a nonlinear attention…
Paper introduces robust learning from feature feedback, even with annotator errors.
problem Learning from human feedback on discriminative features, especially when annotators make mistakes.
method Develops a robust framework for learning with imperfect feedback, deriving regret bounds in adversarial and stochastic settings.
result Regret bounds independent of feature number, showing robust learning is not reducible to non-robust settings.
Graph Random Neural Network improves semi-supervised learning on graphs.
problem Over-smoothing, non-robustness, and weak-generalization in GNNs with few labeled nodes.
method Random propagation strategy and consistency regularization.
result Significantly outperforms state-of-the-art GNN baselines on semi-supervised node classification.
Deep RL policies share adversarial features across different MDPs.
problem Understanding decision boundaries and loss landscapes in neural policies.
method Investigating similarities in high sensitivity directions across MDPs using Arcade Learning Environment.
result High sensitivity directions for neural policies are correlated across MDPs, suggesting shared non-robust features.
We investigate the effect of the dimensionality of the representations learned in Deep Neural Networks (DNNs) on their robustness to input perturbations, both adversarial and random. To achieve low dimensionality of learned representations, we propose an easy-to-use, end-to-end trainable, low-rank regularizer (LR) that…
Despite the exploding interest in graph neural networks there has been little effort to verify and improve their robustness. This is even more alarming given recent findings showing that they are extremely vulnerable to adversarial attacks on both the graph structure and the node attributes. We propose the first method…
Defense against user shilling attacks in collaborative filtering using edge reweighting.
problem Vulnerability of collaborative filtering to profile injection attacks.
method Adversarial robustness based edge reweighting to attenuate non-robust edges.
result Effective defense against various types of attacks demonstrated through experiments.
Improves natural accuracy of deep learning models by combining robust predictions and features.
problem Maintaining natural accuracy while resisting adversarial attacks.
method Ensemble methods combining robust and standard models.
result Optimized natural accuracy through ensemble of robust models.
Robust reinforcement learning aims to produce policies that have strong guarantees even in the face of environments/transition models whose parameters have strong uncertainty. Existing work uses value-based methods and the usual primitive action setting. In this paper, we propose robust methods for learning temporally …
In adversarial learning, discriminator often fails to guide the generator successfully since it distinguishes between real and generated images using silly or non-robust features. To alleviate this problem, this brief presents a simple but effective way that improves the performance of generative adversarial network (G…
RATIO improves neural network robustness and explainability.
problem Neural networks' lack of robustness to adversarial changes and uncertainty on out-distribution samples.
method RATIO: Adversarial Training on In- and Out-distribution.
result RATIO leads to robust models with reliable confidence estimates on out-distribution samples.
This paper provides a non-robust interpretation of the distributionally robust optimization (DRO) problem by relating the distributional uncertainties to the chance probabilities. Our analysis allows a decision-maker to interpret the size of the ambiguity set, which is often lack of business meaning, through the chance…
This work studies adversarial training in high dimensions, revealing key feature trade-offs.
problem Understanding adversarial robustness in high-dimensional settings.
method Introduces a tractable model to study the geometry of data and adversarial attacks.
result Characterizes directions in data associated with robustness vs. usefulness trade-offs.
Adversarial attacks and defenses are currently active areas of research for the deep learning community. A recent review paper divided the defense approaches into three categories; gradient masking, robust optimization, and adversarial example detection. We divide gradient masking and robust optimization differently: (…
Study uses RL to hedge financial derivatives, showing robust strategies outperform non-robust ones.
problem Risk mitigation and gain-seeking in hedging path-dependent financial derivatives.
method Robust risk-aware reinforcement learning (RL) with policy gradient approach.
result Robust hedging strategies outperform non-robust ones under varying data generating processes.
Bayesian investor learns unknown asset drift, trades mean-variance optimal portfolio, but policy is robust to observation model distortion.
problem Bayesian portfolio selection with observation model distortion
method Robust Bayesian portfolio selection
result Robust policy and its price are closed form, with price of robustness half the variance of the non-robust investor's loss.
Federated learning is the centralized training of statistical models from decentralized data on mobile devices while preserving the privacy of each device. We present a robust aggregation approach to make federated learning robust to settings when a fraction of the devices may be sending corrupted updates to the server…
SAM minimizes loss sharpness, improving adversarial transferability.
problem Improving adversarial transferability of deep neural networks.
method Evaluating surrogate models trained with seven minimizers, focusing on loss sharpness and flat neighborhoods.
result SAM minimizes loss sharpness, leading to better adversarial transferability.
Detects adversarial directions to make reinforcement learning policies more robust.
problem Adversarial attacks exploit non-robust directions in reinforcement learning policies, leading to instability.
method Local quadratic approximation of deep neural policy loss to identify non-robust directions.
result Provides a theoretical basis for distinguishing safe from adversarial observations.
Paper explains adversarial training's robust overfitting through a minimax game perspective.
problem Adversarial training suffers from robust overfitting after learning rate decay.
method Viewing adversarial training as a dynamic minimax game, analyzing how LR decay breaks balance and leads to overfitting.
result ReBalanced Adversarial Training (ReBAT) alleviates robust overfitting without sacrificing robustness.
Paper improves bike-sharing demand prediction by adapting to changing patterns.
problem Improving bike-sharing demand prediction under temporal domain shifts.
method Gen-ROTDA, a robust optimal transport-guided residual domain adaptation framework.
result Gen-ROTDA achieves the lowest MAE and is the best OT-family method on average.
New algorithm improves RL performance across different environments.
problem Improving reinforcement learning performance across various environments.
method Designing a fully model-free DRRL algorithm that learns from a single trajectory.
result Demonstrates superior robustness and sample efficiency compared to existing methods.
This study reveals fundamental trade-offs between memorization and robustness in neural networks.
problem Understanding the balance between memorization and robustness in neural networks.
method Analyzes two-layer neural networks in various high-dimensional linearized regimes, focusing on Sobolev-seminorm.
result Establishes fundamental trade-offs between memorization and robustness, with lower bounds on Sobolev-seminorm.
Study on how adversarial training affects neural network kernels and robustness.
problem Understanding and improving adversarial robustness in neural networks.
method Empirical study of the evolution of the empirical Neural Tangent Kernel (NTK) under standard and adversarial training.
result Adversarial training leads to a new kernel that provides robustness, even when non-robust training is performed on top of it.
Robust methods for high-dimensional linear learning improve performance under heavy-tailed distributions and outliers.
problem Efficient learning in high-dimensional settings with robustness to outliers and heavy-tailed data.
method Two algorithms depending on gradient-Lipschitz loss function, applied to sparse, group-sparse, and low-rank matrix recovery.
result Achieved near-optimal estimation rates under heavy-tails and outliers, with computational cost comparable to non-robust methods.
DRO-REBEL improves LLM alignment by robustly updating models online.
problem Overfitting and drifting of LLMs during RLHF.
method DRO-REBEL uses type-p Wasserstein, KL, and χ2 ambiguity sets for robust online updates. result DRO-REBEL achieves faster convergence and better performance than prior methods.
The paper tackles robust classification trees for distribution shifts, improving accuracy in public health and social work.
problem Learning robust classification trees for high-stakes settings with distribution shifts.
method Mixed-integer robust optimization technology to reformulate as a two-stage linear robust optimization problem.
result Increase of up to 12.48% in worst-case accuracy and 4.85% in average-case accuracy.
Adversarial training purifies hidden weights to remove small perturbations.
problem Understanding and removing adversarial perturbations in deep learning models.
method Introducing Feature Purification, a principle that adversarial training aims to remove small dense mixtures in hidden weights.
result Adversarial training can make neural networks robust against small perturbations, even with simple algorithms.
Study robustness of early-stopping GD for linear regression attacks.
problem Robustness of gradient-descent methods to adversarial attacks.
method Early-stopping strategies, gradient-descent, Mahalanobis attacks, feature-dependent learning rates, data transformations.
result Early-stopped GD is optimally robust to Euclidean-norm attacks but sub-optimal for Mahalanobis attacks.
Using predictive models to identify patterns that can act as biomarkers for different neuropathoglogical conditions is becoming highly prevalent. In this paper, we consider the problem of Autism Spectrum Disorder (ASD) classification where previous work has shown that it can be beneficial to incorporate a wide variety …
We investigate the possibility of statistical evaluation of the market completeness for discrete time stock market models. It is known that the market completeness is not a robust property: small random deviations of the coefficients convert a complete market model into a incomplete one. The paper shows that market inc…
Paper introduces robust learning methods using coordinate gradient descent.
problem Supervised learning with corrupted features and labels.
method Coordinate gradient descent combined with robust estimators of partial derivatives.
result Robust learning methods with nearly identical numerical complexity to non-robust ones.
Recent studies on the adversarial vulnerability of neural networks have shown that models trained to be more robust to adversarial attacks exhibit more interpretable saliency maps than their non-robust counterparts. We aim to quantify this behavior by considering the alignment between input image and saliency map. We h…
Framework for robust control under model uncertainty, improving financial derivatives hedging.
problem Model uncertainty in financial derivatives hedging.
method Dynamic programming principle for solving one-step optimization problems.
result Robust hedging strategy outperforms model-based strategies during adverse scenarios.
New method estimates policy performance under unobserved confounding.
problem Estimating policy performance when decisions depend on unobserved variables.
method Developed worst-case bounds for robust OPE under unobserved confounding.
result Efficient procedure for computing worst-case bounds, proving statistical consistency.
Generative adversarial networks (GANs) are designed with the help of min-max optimization problems that are solved with stochastic gradient-type algorithms which are known to be non-robust. In this work we revisit a non-adversarial method based on kernels which relies on a pure minimization problem and propose a simple…
In recent years several adversarial attacks and defenses have been proposed. Often seemingly robust models turn out to be non-robust when more sophisticated attacks are used. One way out of this dilemma are provable robustness guarantees. While provably robust models for specific lp-perturbation models have been dev…